A Mailing List Nobody Has Cleaned Since 2014

The list from 2014

In the spring of 2014, with Canada's anti-spam law about to take effect, many businesses went through their mailing lists for the first time.

Some sent emails asking people to confirm. Others decided their customers were covered and carried on. Either way, the list was tidied once.

Most have not been touched since. Addresses from the till, the website and old order forms have kept arriving, and nothing has left.

Nearly five years on, a good part of the list is people the business no longer has permission to email, mixed in with addresses that no longer exist.

What has gone stale

• Implied consent from purchases made more than two years ago.
• Consent from enquiries, which lapses after six months.
• Addresses that bounce, because the mailbox closed or the person moved on.
• People who never open anything, sometimes for years.
• Addresses with no record of how or when they joined.
• Typing errors, such as gmial.com, bouncing every month.

The first is the one most owners do not realise has a clock on it. A customer who last bought in 2016 could be emailed on implied consent until 2018. Without their express agreement, not since.

How consent works under CASL

CASL, in force since July 2014, requires consent before a business sends a commercial email, and it recognises two kinds.

Express consent is a clear yes: somebody ticked an unticked box or signed up, having been told who was asking and why. It lasts until they unsubscribe.

Implied consent comes from a relationship. A purchase gives two years from the date of purchase, and each new purchase restarts the clock. An enquiry gives six months.

The transition that let older relationships carry on ended in July 2017. Every address now has to fit the ordinary rules, and if anyone asks, the business has to show the consent it relied on.

Why dead addresses hurt the live ones

Gmail, Outlook and the other big providers decide where a newsletter lands partly by how the sender's list behaves.

Sending to addresses that bounce, and to people who never open or who mark you as spam, looks like what spammers do. Mail from senders like that drifts into junk folders.

That affects everyone on the list, including the customers who want to hear from you. Some abandoned addresses are even turned into traps by mail providers, to catch senders who never clean their lists.

Sorting the list into three

Export the list with every date the mailing service holds: when each address joined, how, and when it last opened anything. Remove hard bounces first, since those addresses do not exist.

Then sort. The first group gave express consent and you can show it. The second has implied consent still in date, which usually means matching the list against your sales records.

The third is everybody else: expired implied consent, or no record at all of where the address came from.

The re-permission email

The second group is where a re-permission email belongs: one short message asking people to confirm they want to keep hearing from you.

Under CASL, an email asking for consent is itself a commercial email, so it can only go to people you still have consent to email. That rules out the third group entirely.

Say who you are, what they will receive and how often, and give them one clear button. Those who confirm move to the first group, with the date recorded.

Those who do not confirm can still be emailed until their implied consent runs out, and a new purchase restarts the clock. Note each expiry date, and remove them when it passes.

A worked example

A garden centre on the edge of town had built its newsletter list since 2009, from a sign-up box at the till, a website form and workshop registrations.

The list went into a mailing service in 2014 and grew every spring after that. By last year, much of each newsletter bounced or sat unopened, and customers mentioned finding it in junk.

Nobody could say where several hundred of the addresses had come from. The till sign-ups had no consent wording at all, so for most of them the only basis was the date of a purchase.

Website sign-ups, made through a form with clear wording, stayed as they were.

The rest were matched against the loyalty records. Customers who had bought in the last two years received a re-permission email before the first spring newsletter; everyone else was removed.

The till now asks a clear question and records the answer and the date. The list is much smaller, and every address on it has a source and a date beside it.

Keeping consent records

CASL puts the burden of proof on the sender. If a complaint arrives, the business has to show what consent it had for that address.

For express consent, that means the date, the method and the exact wording agreed to. Keep a dated copy of every sign-up form and every question asked at the till.

For implied consent, it means the date of the purchase or enquiry, which usually sits in the sales system rather than the mailing service.

Addresses imported from an old spreadsheet carry only the import date, which proves nothing about consent.

What every message needs

Consent is only half of it. Every commercial email has to identify the business, with a mailing address and a phone number, email address or website, and include an unsubscribe link that works.

Unsubscribes have to be honoured within ten business days. A mailing service handles that automatically; a list kept in an Outlook contact group does not.

The counter-case

Not every list needs this much work.

A list built entirely through a clear sign-up form, with the service recording each address, is mostly in good order already. Checking the bounces and the wording may be all it needs.

A business emailing a few dozen regulars who buy every month has implied consent renewing constantly, though asking for express consent still costs nothing.

But a list that has grown untended since 2014 should be sorted before the next send, however small it ends up.

The clean-up, in order

1. Export the list with every date held.
2. Remove hard bounces and obvious typos.
3. Sort into three groups by consent.
4. Stop sending to the third group.
5. Send one re-permission email to the second.
6. Record consent for every address you keep.
7. Add clear wording to every sign-up point.

Step four is the one that feels like a loss. The list shrinks, sometimes dramatically, but those addresses were never safe to email, and they were dragging delivery down for everyone else.

Why a customer list is also a privacy responsibility is covered in the breach log federal privacy law now requires.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.